"Kriz" virus returns home for holidays

"Kriz," a year-old computer virus, may be coming back for Christmas this year, thanks to its ability to piggyback on other viruses and spread with them.

The Kriz virus, also known as the "W32.Kriz," is based on the "CIH," or
"Chernobyl," virus, which damaged computers worldwide when it was triggered
April 26, 1998. Antivirus software maker Symantec on Tuesday warned people
to scan their computers before Christmas; the company released a free
tool to scan for the virus and remove it.

"Worms by their nature propagate pretty quickly," said Marian Merritt,
group product manager for Symantec. "And when they get on a computer with
Kriz, they start spreading that."

Symantec and other antivirus software already scan for the virus in their
standalone
programs.

The Kriz virus spreads to a computer when someone opens an infected file,
changing the basic program that runs the operating system, known as the kernel. The virus also infects other programs on the computer's hard
drive and any mapped drives, leaving open the possibility that it could travel across company networks.

"It may have spread itself to all your executables, but you are only a
carrier of the virus," said Symantec's Merritt. "The real payload hits on
Dec. 25."

When the virus triggers, it overwrites all files on the computer and then
attempts to erase the software foundation of the PC, known as the basic
input-output system (BIOS). Although the BIOS attack only occasionally works, the other attacks
can be extremely
destructive.

Symantec rival Trend Micro said it believes the virus will not spread
far but warns that its ability to combine with other viruses could change
that.

Both Trend Micro and Symantec reported that the virus has infected two
other worms: "Happy99.worm," also known as "W32.Ska," and
"W32.hllw.bymer.worm."

"Kriz is a destructive virus but a really slow infector," said Joe
Hartmann, antivirus researcher for Trend Micro. "Yet it's now infected a
mass mailer, so now you have
a destructive virus that's also a mass mailer."

In the past 24 hours, Kriz
ranked No. 8 on Trend Micro's Worldwide Virus Tracking Center in terms of
how many files the virus had infected. The tracking center is a real-time
database of the types of viruses found by Trend Micro's online House Call
scanner.

In North America, the virus ranked No. 6 for files infected. Despite that,
the virus has not yet spread widely and is known to have infected about 50
computers in the last 24 hours. Because the tracking center only follows
viruses that have infected people who use Trend Micro's online service, the
actual number could be much greater.

Historians are taking heed, however.

The Kriz virus is essentially a copy of the CIH virus, which was created in
1997 by Cheng Ing-Hau of Taiwan. CIH fizzled in its first year, and a
variant that struck
every month died out quickly. However, the annual variant did significantly
more damage when it was triggered in April 1998.